Incident
incident:nicehash_hack
December 2017 compromise in which attackers obtained access to NiceHash wallet private keys and transferred Bitcoin worth about $75 million at the time.
December 2017 compromise in which attackers obtained access to NiceHash wallet private keys and transferred Bitcoin worth about $75 million at the time.
“they transferred out Bitcoins worth about $75 million”
“found where the private keys were for the Bitcoin wallets and just drained everything”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INITIAL_ACCESS_VIA | phishing | Explicit | 119 |
| outgoing | INVOLVES | lateral movement | Explicit | 119 |
| outgoing | INVOLVES | privilege escalation | Explicit | 119 |
| outgoing | COMPROMISES | NiceHash | Explicit | 119 |
| outgoing | INVOLVES | cryptocurrency wallet private key | Explicit | 119 |
| outgoing | ATTRIBUTED_TO | Lazarus Group | Attributed | 119 |
NiceHash hack INITIAL_ACCESS_VIA phishing
Employees at NiceHash received phishing emails, and an employee apparently clicked one, opened its attachment, and became infected.
Explicit Confidence 99% · Geoff White EP 119 Details
“Employees at NiceHash start to get phishing e-mails sent to them”
NiceHash hack INVOLVES lateral movement
After compromising an employee computer, the attackers moved deeper into the NiceHash network.
Explicit Confidence 98% · Jack Rhysider EP 119 Details
“they burrowed their way deeper into the NiceHash network, pivoting”
NiceHash hack INVOLVES privilege escalation
The attackers escalated their privileges while moving through the NiceHash network.
Explicit Confidence 99% · Jack Rhysider EP 119 Details
“pivoting and escalating their privileges”
NiceHash hack COMPROMISES NiceHash
The attackers gained access to NiceHash systems and drained cryptocurrency from its wallets.
Explicit Confidence 99% · Jack Rhysider EP 119 Details
“this attacker got into NiceHash’s systems and found where the private keys were”
NiceHash hack INVOLVES cryptocurrency wallet private key
The attackers sought NiceHash's Bitcoin wallet private keys in order to empty the wallets.
Explicit Confidence 99% · Jack Rhysider EP 119 Details
“NiceHash’s Bitcoin wallet private keys”
NiceHash hack ATTRIBUTED_TO Lazarus Group
According to the FBI, the NiceHash theft was the work of the Lazarus Group.
Attributed Confidence 95% · Geoff White EP 119 Details
“according to the FBI, this was the work of the Lazarus Group”